255363 matches found
CVE-2026-74343 kernfs: fix xattr race condition with multiple superblocks
In the Linux kernel, the following vulnerability has been resolved: kernfs: fix xattr race condition with multiple superblocks Multiple superblocks with different namespaces can share the same kernfsnode when kernfstestsuper finds a matching root but different namespace. This means multiple inode...
EUVD-2026-58937
In the Linux kernel, the following vulnerability has been resolved: riscv: cacheinfo: Fix node reference leak in populatecacheleaves Currently, the while loop drops the reference to prev in each iteration. If the loop terminates early due to a break, the final ofnodeputnp correctly drops the...
CVE-2026-72179 riscv: cacheinfo: Fix node reference leak in populate_cache_leaves
In the Linux kernel, the following vulnerability has been resolved: riscv: cacheinfo: Fix node reference leak in populatecacheleaves Currently, the while loop drops the reference to prev in each iteration. If the loop terminates early due to a break, the final ofnodeputnp correctly drops the...
CVE-2026-72179
The CVE-2026-72179 entry concerns the Linux kernel (riscv) cacheinfo: populate_cache_leaves. A node reference leak occurs because the final of_node_put(np) can leak the last valid node when the loop finishes with np == NULL. The fix, as documented in multiple sources, changes the final call from ...
CVE-2026-72026
The CVE-2026-72026 vulnerability is in the Linux kernel IRQ subsystem for riscv IMSIC early initialization. The issue: imsic_early_acpi_init() allocates a firmware node before IMSIC state setup; if imsic_setup_state() fails, the allocated fwnode is not freed. The fix adds cleanup on the error pat...
EUVD-2026-58824
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface...
PT-2026-73056
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Stored Cross-Site Scripting XSS occurs because attribute-view field names are stored without HTML escaping and interpolated directly into option elements using innerHTML within the sort menu. An...
PT-2026-73050
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A remote code execution issue exists in the Template calculation operator. The software renders user-authored Go templates and stores the output without sanitization. This allows attackers to inject...
PT-2026-72367
In the Linux kernel, the following vulnerability has been resolved: riscv: cacheinfo: Fix node reference leak in populate cache leaves Currently, the while loop drops the reference to prev in each iteration. If the loop terminates early due to a break, the final of node putnp correctly drops the...
PT-2026-73051
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Stored cross-site scripting is possible due to a failure to validate or escape table column width values, which allows injection into style attributes. An attacker can use the 'setAttrViewColWidth' AP...
PT-2026-73057
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A cross-site scripting issue exists in the unicode2Emoji function due to a failure to sanitize codepoint branch output. This allows attackers to create document icons containing hex-encoded markup. Wh...
PT-2026-72897
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: reject DX BIND QUERY without a DX context vmw cmd dx bind query unconditionally dereferences sw context-dx ctx node-ctx. Userspace can trigger a NULL pointer dereference from any render-node fd by submitting an execbu...
Linux Distros Unpatched Vulnerability : CVE-2026-74445
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/vmwgfx: reject DXBINDQUERY without a DX context vmwcmddxbindquery unconditionally dereferences swcontext-dxctxnode-ctx. Userspace can trigger a NULL pointer...
PT-2026-72819
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix out-of-bounds access in nvme setup descriptor pools nvme setup descriptor pools indexes dev-descriptor pools using the numa node forwarded from hctx-numa node by its single caller, nvme init hctx common. On a non-NU...
CVE-2026-56860 vulnerabilities
Vulnerabilities for packages: kyverno-policy-reporter-kyverno-plugin-fips, rancher-helm, terraform, harvester, atlas-fips, aws-iam-authenticator-fips, spiffe-helper, oauth2-proxy, crossplane-provider-aws-bedrockagent-fips, rancher-machine, cert-manager-openshift-routes-fips, pgpool2exporter,...
GHSA-5FPJ-28RV-84R7 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist
Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...
CVE-2026-73566
A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could provide a specially crafted tar archive with a long-path header. When processing this archive with a non-empty member-selection list, an uncontrolled recursion in the filesFilter function can lea...
ROOT-APP-NPM-CVE-2026-41673 CVE-2026-41673 in @xmldom/xmldom - Patched by Root
Root has patched CVE-2026-41673 in the @xmldom/xmldom package for Root:npm. Multiple fixed versions available...